How Parameter Labs Used ChatGPT HTML Previews to Access Private Account Data
How We Took Over ChatGPT Accounts
- Who
- OpenAI
- What
- fixed a ChatGPT vulnerability that allowed private user data to be exfiltrated or actions to be taken on users' behalf
- Quote
OpenAI closed the hole and paid out a $5,000 bug bounty, which I think was a bit cheap for a vulnerability this serious.
What happened
Parameter Labs found an exploit chain that let a ChatGPT share URL exfiltrate private data or take actions on behalf of another signed-in user who visited it, Simon Willison reports. The attack combined MathLive message handling, HTML injection, an unsandboxed iframe, and YouTube’s oEmbed endpoint to execute JavaScript despite OpenAI’s CSP restrictions. OpenAI fixed the vulnerability and paid a $5,000 bug bounty, which Willison considers low for its severity.
Why it matters
The exploit illustrates how a sandboxed HTML preview could reach private account data through weaknesses spanning message handling, HTML injection, and permitted script sources.
Read next
See the full storyOpenAI Fixes ChatGPT Share-Link Exploit That Could Expose Private DataThe story so far
OpenAI fixed a ChatGPT vulnerability that could let an attacker steal private account data or act on behalf of another signed-in user who visited a crafted ChatGPT share URL, and paid a $5,000 bug bounty, Simon Willison reported. Parameter Labs discovered the exploit chain, which combined MathLive message handling, HTML injection, an unsandboxed iframe, and YouTube’s oEmbed endpoint to execute JavaScript despite OpenAI’s Content Security Policy restrictions. Willison described the bounty as low given the vulnerability’s severity.
Keep up with AI, one email a day
Model releases, price changes and compute developments, with original sources. Free, confirmed by email, and easy to unsubscribe. Read a past issue · 2026-11-01